Security firm Huntress documented a set of intrusions in September and October where attackers used compromised camera management software as a foothold to plant remote access tools across multiple customer networks. The campaign relied on a consistent technique: hijacking a legitimate Windows executable to quietly load malicious code.
An Overlooked Application as Entry Point
In each incident, investigators traced initial access back to an executable called CMS.exe, running from C:Program Files (x86)CMSCMS.exe. Huntress could not confirm the software's exact product name or vendor because the file lacked embedded version information, and missing application logs prevented analysts from reconstructing exactly how the program was first breached.
Researchers did find suggestive strings inside the binary, including a reference to a domain tied to the Korean company 3R Global, and noted that a CMS package available through a site called kvision.ai contained matching code and the same web address. Huntress was careful to note this does not confirm where victims obtained their software or establish a formal vendor relationship - it's a possible lead, not a verified source of compromise.
How the Attackers Moved Through Infected Systems
Once inside, attackers followed a repeatable playbook. They dropped a file named rs.win32.exe into a user's AppData folder, configured with a remote IP address, port 8000, and login credentials - details that led Huntress to classify it as a reverse shell granting remote command access.
They then placed a copy of WpcMon.exe, the genuine Microsoft Windows Parental Control Monitor tool, inside an unusual location under the user's AppData directory rather than its normal home in the Windows system folder. Alongside it, attackers dropped two modified DLL files, IPHLPAPI.DLL and samcli.dll, disguised as ordinary compression utilities but altered to periodically contact an external server at 144.172.116.37, a command-and-control address seen across every observed case.
This technique, known as DLL sideloading, exploits the trust Windows places in signed, legitimate executables: when WpcMon.exe runs, it unknowingly loads the attacker's malicious code instead of the real library. To persist across reboots, the attackers added a registry entry under the compromised user's Run key, ensuring the payload launched automatically at every login.
What Organizations Can Do
Huntress recommends that businesses inventory any camera management or similar niche applications running on their networks, since such tools are often overlooked during security reviews despite having broad system access. The firm also advises restricting unnecessary permissions for these applications and watching for unexpected child processes or outbound network connections tied to them.
Where feasible, application control policies should block unapproved executables and DLL files from running out of user-writable folders - a step that would have interrupted this particular attack chain at multiple points.